from django.shortcuts import render, redirect, get_object_or_404 from django.contrib.auth import authenticate, login, logout from django.contrib.auth.models import User from django.contrib import messages from django.db.models import Sum, Count, Q from django.utils import timezone from django.core.paginator import Paginator from django.http import JsonResponse import json from datetime import timedelta from .forms import SiteSettingForm from django.core.mail import send_mail from django.template.loader import render_to_string from django.utils.html import strip_tags from django.conf import settings from store.models import Product, Category, Review, Coupon from orders.models import Order, OrderItem, UserProfile from .models import StaffProfile, ActivityLog, SiteSetting from .permissions import ( require_staff, require_superadmin, require_permission, log_activity, get_user_permissions, get_staff_profile ) # ─── AUTH ────────────────────────────────────────────────────────────────────── def dashboard_login(request): if request.user.is_authenticated and get_user_permissions(request.user): return redirect('dashboard:home') if request.method == 'POST': username = request.POST.get('username', '').strip() password = request.POST.get('password', '') user = authenticate(request, username=username, password=password) if user: perms = get_user_permissions(user) if perms or user.is_superuser or user.is_staff: login(request, user) log_activity(user, 'Logged in to dashboard', request=request) return redirect(request.GET.get('next', 'dashboard:home')) else: messages.error(request, 'Your account does not have dashboard access.') else: messages.error(request, 'Invalid username or password.') return render(request, 'dashboard/login.html') def dashboard_logout(request): if request.user.is_authenticated: log_activity(request.user, 'Logged out of dashboard', request=request) logout(request) return redirect('dashboard:login') # ─── DASHBOARD HOME ───────────────────────────────────────────────────────────── @require_staff def dashboard_home(request): now = timezone.now() thirty_days_ago = now - timedelta(days=30) total_revenue = Order.objects.filter( status__in=['paid','processing','shipped','delivered'] ).aggregate(t=Sum('total'))['t'] or 0 month_revenue = Order.objects.filter( created_at__gte=thirty_days_ago, status__in=['paid','processing','shipped','delivered'] ).aggregate(t=Sum('total'))['t'] or 0 total_orders = Order.objects.count() pending_orders = Order.objects.filter(status='pending').count() total_products = Product.objects.filter(is_active=True).count() low_stock = Product.objects.filter(stock__lte=5, is_active=True).count() total_customers = User.objects.filter(is_staff=False, is_superuser=False).count() new_customers = User.objects.filter( date_joined__gte=thirty_days_ago, is_staff=False, is_superuser=False ).count() recent_orders = Order.objects.select_related('user').order_by('-created_at')[:8] sales_data = [] for i in range(6, -1, -1): day = now - timedelta(days=i) day_start = day.replace(hour=0, minute=0, second=0, microsecond=0) day_end = day_start + timedelta(days=1) rev = Order.objects.filter( created_at__gte=day_start, created_at__lt=day_end, status__in=['paid','processing','shipped','delivered'] ).aggregate(t=Sum('total'))['t'] or 0 sales_data.append({'label': day.strftime('%a'), 'value': float(rev)}) cat_data = [] for cat in Category.objects.filter(is_active=True): count = cat.products.filter(is_active=True).count() cat_data.append({'name': cat.name, 'count': count}) cat_data.sort(key=lambda x: x['count'], reverse=True) top_products = OrderItem.objects.values( 'product__name', 'product__id' ).annotate(total_sold=Sum('quantity'), total_rev=Sum('product_price') ).order_by('-total_sold')[:5] recent_logs = ActivityLog.objects.select_related('user').order_by('-timestamp')[:10] context = { 'total_revenue': total_revenue, 'month_revenue': month_revenue, 'total_orders': total_orders, 'pending_orders': pending_orders, 'total_products': total_products, 'low_stock': low_stock, 'total_customers': total_customers, 'new_customers': new_customers, 'recent_orders': recent_orders, 'sales_data': json.dumps(sales_data), 'cat_data': json.dumps(cat_data[:6]), 'top_products': top_products, 'recent_logs': recent_logs, } return render(request, 'dashboard/home.html', context) # ─── PRODUCTS ────────────────────────────────────────────────────────────────── @require_staff @require_permission('can_manage_products') def product_list(request): products = Product.objects.select_related('category').order_by('-created_at') q = request.GET.get('q', '') cat_filter = request.GET.get('category', '') status_filter = request.GET.get('status', '') if q: products = products.filter(Q(name__icontains=q) | Q(description__icontains=q)) if cat_filter: products = products.filter(category__slug=cat_filter) if status_filter == 'active': products = products.filter(is_active=True) elif status_filter == 'inactive': products = products.filter(is_active=False) elif status_filter == 'low_stock': products = products.filter(stock__lte=5) elif status_filter == 'out_of_stock': products = products.filter(stock=0) paginator = Paginator(products, 15) page_obj = paginator.get_page(request.GET.get('page')) categories = Category.objects.filter(is_active=True) return render(request, 'dashboard/products.html', { 'products': page_obj, 'categories': categories, 'q': q, 'cat_filter': cat_filter, 'status_filter': status_filter, }) @require_staff @require_permission('can_manage_products') def product_add(request): categories = Category.objects.filter(is_active=True) if request.method == 'POST': try: cat = Category.objects.get(id=request.POST['category']) product = Product.objects.create( name=request.POST['name'], category=cat, description=request.POST['description'], price=request.POST['price'], discount_price=request.POST['discount_price'] or None, stock=request.POST['stock'], sizes=request.POST.get('sizes',''), colors=request.POST.get('colors',''), is_active='is_active' in request.POST, is_featured='is_featured' in request.POST, is_new_arrival='is_new_arrival' in request.POST, is_best_seller='is_best_seller' in request.POST, ) for field in ('image','image2','image3'): if field in request.FILES: setattr(product, field, request.FILES[field]) product.save() log_activity(request.user, f'Created product: {product.name}', request=request) messages.success(request, f'Product "{product.name}" created!') return redirect('dashboard:product_list') except Exception as e: messages.error(request, f'Error: {e}') return render(request, 'dashboard/product_form.html', {'categories': categories, 'action': 'Add'}) @require_staff @require_permission('can_manage_products') def product_edit(request, pk): product = get_object_or_404(Product, pk=pk) categories = Category.objects.filter(is_active=True) if request.method == 'POST': try: product.name = request.POST['name'] product.category = Category.objects.get(id=request.POST['category']) product.description = request.POST['description'] product.price = request.POST['price'] product.discount_price= request.POST['discount_price'] or None product.stock = request.POST['stock'] product.sizes = request.POST.get('sizes','') product.colors = request.POST.get('colors','') product.is_active = 'is_active' in request.POST product.is_featured = 'is_featured' in request.POST product.is_new_arrival= 'is_new_arrival' in request.POST product.is_best_seller= 'is_best_seller' in request.POST for field in ('image','image2','image3'): if field in request.FILES: setattr(product, field, request.FILES[field]) product.save() log_activity(request.user, f'Updated product: {product.name}', request=request) messages.success(request, f'Product "{product.name}" updated!') return redirect('dashboard:product_list') except Exception as e: messages.error(request, f'Error: {e}') return render(request, 'dashboard/product_form.html', { 'product': product, 'categories': categories, 'action': 'Edit' }) @require_staff @require_permission('can_manage_products') def product_delete(request, pk): product = get_object_or_404(Product, pk=pk) if request.method == 'POST': name = product.name product.delete() log_activity(request.user, f'Deleted product: {name}', request=request) messages.success(request, f'Product "{name}" deleted.') return redirect('dashboard:product_list') @require_staff @require_permission('can_manage_products') def product_toggle(request, pk): product = get_object_or_404(Product, pk=pk) product.is_active = not product.is_active product.save() state = 'activated' if product.is_active else 'deactivated' log_activity(request.user, f'Product {state}: {product.name}', request=request) messages.success(request, f'"{product.name}" {state}.') return redirect('dashboard:product_list') # ─── CATEGORIES ──────────────────────────────────────────────────────────────── @require_staff @require_permission('can_manage_categories') def category_list(request): cats = Category.objects.annotate(product_count=Count('products')).order_by('order','name') return render(request, 'dashboard/categories.html', {'categories': cats}) @require_staff @require_permission('can_manage_categories') def category_add(request): if request.method == 'POST': name = request.POST.get('name','').strip() if name: cat = Category.objects.create( name=name, description=request.POST.get('description',''), order=request.POST.get('order',0), is_active='is_active' in request.POST, ) if 'image' in request.FILES: cat.image = request.FILES['image'] cat.save() log_activity(request.user, f'Created category: {name}', request=request) messages.success(request, f'Category "{name}" created!') return redirect('dashboard:category_list') return render(request, 'dashboard/category_form.html', {'action': 'Add'}) @require_staff @require_permission('can_manage_categories') def category_edit(request, pk): cat = get_object_or_404(Category, pk=pk) if request.method == 'POST': cat.name = request.POST.get('name', cat.name) cat.description = request.POST.get('description','') cat.order = request.POST.get('order', 0) cat.is_active = 'is_active' in request.POST if 'image' in request.FILES: cat.image = request.FILES['image'] cat.save() log_activity(request.user, f'Updated category: {cat.name}', request=request) messages.success(request, f'Category "{cat.name}" updated!') return redirect('dashboard:category_list') return render(request, 'dashboard/category_form.html', {'category': cat, 'action': 'Edit'}) @require_staff @require_permission('can_manage_categories') def category_delete(request, pk): cat = get_object_or_404(Category, pk=pk) if request.method == 'POST': name = cat.name cat.delete() log_activity(request.user, f'Deleted category: {name}', request=request) messages.success(request, f'Category "{name}" deleted.') return redirect('dashboard:category_list') # ─── ORDERS ──────────────────────────────────────────────────────────────────── @require_staff @require_permission('can_manage_orders') def order_list(request): orders = Order.objects.select_related('user').order_by('-created_at') status_filter = request.GET.get('status','') q = request.GET.get('q','') if status_filter: orders = orders.filter(status=status_filter) if q: orders = orders.filter( Q(order_number__icontains=q) | Q(full_name__icontains=q) | Q(email__icontains=q) | Q(phone__icontains=q) ) paginator = Paginator(orders, 20) page_obj = paginator.get_page(request.GET.get('page')) return render(request, 'dashboard/orders.html', { 'orders': page_obj, 'status_filter': status_filter, 'q': q, 'status_choices': Order.STATUS_CHOICES, }) # @require_staff # @require_permission('can_manage_orders') # def order_detail(request, pk): # order = get_object_or_404(Order, pk=pk) # if request.method == 'POST': # new_status = request.POST.get('status') # is_paid = 'is_paid' in request.POST # if new_status in dict(Order.STATUS_CHOICES): # old = order.status # order.status = new_status # order.is_paid = is_paid # order.save() # log_activity(request.user, f'Order #{order.order_number} status: {old} → {new_status}', request=request) # messages.success(request, f'Order #{order.order_number} updated.') # return redirect('dashboard:order_detail', pk=pk) # return render(request, 'dashboard/order_detail.html', { # 'order': order, 'status_choices': Order.STATUS_CHOICES, # }) @require_staff @require_permission('can_manage_orders') def order_detail(request, pk): order = get_object_or_404(Order, pk=pk) if request.method == 'POST': new_status = request.POST.get('status') is_paid = 'is_paid' in request.POST if new_status in dict(Order.STATUS_CHOICES): old_status = order.status old_is_paid = order.is_paid order.status = new_status order.is_paid = is_paid order.save() log_activity( request.user, f'Order #{order.order_number} status: {old_status} → {new_status}', request=request ) # --- Send email only if something meaningful changed --- status_changed = old_status != new_status payment_changed = old_is_paid != is_paid if status_changed or payment_changed: _send_order_status_email(order, old_status) messages.success(request, f'Order #{order.order_number} updated.') return redirect('dashboard:order_detail', pk=pk) return render(request, 'dashboard/order_detail.html', { 'order': order, 'status_choices': Order.STATUS_CHOICES, }) def _send_order_status_email(order, old_status): """Send a status update email to the customer.""" # Human-readable labels and matching emoji per status STATUS_META = { 'pending': {'label': 'Pending', 'emoji': '🕐', 'color': '#f0a500'}, 'confirmed': {'label': 'Confirmed', 'emoji': '✅', 'color': '#4caf7d'}, 'processing': {'label': 'Processing', 'emoji': '⚙️', 'color': '#2196f3'}, 'shipped': {'label': 'Shipped', 'emoji': '🚚', 'color': '#9c27b0'}, 'delivered': {'label': 'Delivered', 'emoji': '📦', 'color': '#4caf7d'}, 'cancelled': {'label': 'Cancelled', 'emoji': '❌', 'color': '#f44336'}, } meta = STATUS_META.get(order.status, {'label': order.status.title(), 'emoji': '📋', 'color': '#888888'}) context = { 'order': order, 'old_status': old_status.title(), 'new_status': meta['label'], 'emoji': meta['emoji'], 'color': meta['color'], 'items': order.items.all(), # adjust related_name if different 'is_paid': order.is_paid, 'site_name': getattr(settings, 'SITE_NAME', 'Chiez Stores'), 'support_whatsapp': getattr(settings, 'SUPPORT_WHATSAPP', ''), } subject = f"{meta['emoji']} Order #{order.order_number} — {meta['label']}" html_body = render_to_string('orders/emails/order_status_update.html', context) plain_body = strip_tags(html_body) try: send_mail( subject=subject, message=plain_body, from_email=settings.DEFAULT_FROM_EMAIL, recipient_list=[order.email], html_message=html_body, fail_silently=False, ) except Exception as e: # Log but don't crash the request if email fails import logging logger = logging.getLogger(__name__) logger.error(f"Failed to send status email for order #{order.order_number}: {e}") # ─── CUSTOMERS ───────────────────────────────────────────────────────────────── @require_staff @require_permission('can_manage_customers') def customer_list(request): users = User.objects.filter(is_staff=False, is_superuser=False).annotate( order_count=Count('orders'), total_spent=Sum('orders__total') ).order_by('-date_joined') q = request.GET.get('q','') if q: users = users.filter( Q(username__icontains=q) | Q(email__icontains=q) | Q(first_name__icontains=q) | Q(last_name__icontains=q) ) paginator = Paginator(users, 20) page_obj = paginator.get_page(request.GET.get('page')) return render(request, 'dashboard/customers.html', {'customers': page_obj, 'q': q}) @require_staff @require_permission('can_manage_customers') def customer_detail(request, pk): customer = get_object_or_404(User, pk=pk) orders = Order.objects.filter(user=customer).order_by('-created_at') profile = getattr(customer, 'profile', None) return render(request, 'dashboard/customer_detail.html', { 'customer': customer, 'orders': orders, 'profile': profile, }) # ─── COUPONS ─────────────────────────────────────────────────────────────────── @require_staff @require_permission('can_manage_coupons') def coupon_list(request): coupons = Coupon.objects.order_by('-created_at') return render(request, 'dashboard/coupons.html', {'coupons': coupons}) @require_staff @require_permission('can_manage_coupons') def coupon_add(request): if request.method == 'POST': try: Coupon.objects.create( code=request.POST['code'].upper().strip(), discount_type=request.POST['discount_type'], discount_value=request.POST['discount_value'], minimum_order=request.POST.get('minimum_order',0), max_uses=request.POST.get('max_uses',0), is_active='is_active' in request.POST, valid_from=request.POST['valid_from'], valid_until=request.POST['valid_until'], ) log_activity(request.user, f"Created coupon: {request.POST['code'].upper()}", request=request) messages.success(request, 'Coupon created!') return redirect('dashboard:coupon_list') except Exception as e: messages.error(request, f'Error: {e}') return render(request, 'dashboard/coupon_form.html', {'action': 'Add'}) @require_staff @require_permission('can_manage_coupons') def coupon_edit(request, pk): coupon = get_object_or_404(Coupon, pk=pk) if request.method == 'POST': coupon.code = request.POST['code'].upper().strip() coupon.discount_type = request.POST['discount_type'] coupon.discount_value = request.POST['discount_value'] coupon.minimum_order = request.POST.get('minimum_order',0) coupon.max_uses = request.POST.get('max_uses',0) coupon.is_active = 'is_active' in request.POST coupon.valid_from = request.POST['valid_from'] coupon.valid_until = request.POST['valid_until'] coupon.save() log_activity(request.user, f'Updated coupon: {coupon.code}', request=request) messages.success(request, 'Coupon updated!') return redirect('dashboard:coupon_list') return render(request, 'dashboard/coupon_form.html', {'coupon': coupon, 'action': 'Edit'}) @require_staff @require_permission('can_manage_coupons') def coupon_delete(request, pk): coupon = get_object_or_404(Coupon, pk=pk) if request.method == 'POST': code = coupon.code coupon.delete() log_activity(request.user, f'Deleted coupon: {code}', request=request) messages.success(request, 'Coupon deleted.') return redirect('dashboard:coupon_list') # ─── REVIEWS ─────────────────────────────────────────────────────────────────── @require_staff @require_permission('can_manage_reviews') def review_list(request): reviews = Review.objects.select_related('product','user').order_by('-created_at') status_filter = request.GET.get('status','') if status_filter == 'approved': reviews = reviews.filter(is_approved=True) elif status_filter == 'pending': reviews = reviews.filter(is_approved=False) paginator = Paginator(reviews, 20) page_obj = paginator.get_page(request.GET.get('page')) return render(request, 'dashboard/reviews.html', { 'reviews': page_obj, 'status_filter': status_filter }) @require_staff @require_permission('can_manage_reviews') def review_toggle(request, pk): review = get_object_or_404(Review, pk=pk) review.is_approved = not review.is_approved review.save() messages.success(request, 'Review status updated.') return redirect('dashboard:review_list') @require_staff @require_permission('can_manage_reviews') def review_delete(request, pk): review = get_object_or_404(Review, pk=pk) if request.method == 'POST': review.delete() messages.success(request, 'Review deleted.') return redirect('dashboard:review_list') # ─── ANALYTICS ───────────────────────────────────────────────────────────────── @require_staff @require_permission('can_view_analytics') def analytics(request): now = timezone.now() monthly = [] for i in range(5, -1, -1): month_start = (now.replace(day=1) - timedelta(days=i*28)).replace(day=1, hour=0, minute=0, second=0) month_end = now if i == 0 else (month_start + timedelta(days=32)).replace(day=1) rev = Order.objects.filter( created_at__gte=month_start, created_at__lt=month_end, status__in=['paid','processing','shipped','delivered'] ).aggregate(t=Sum('total'))['t'] or 0 monthly.append({'label': month_start.strftime('%b'), 'value': float(rev)}) status_counts = {s: Order.objects.filter(status=s).count() for s, _ in Order.STATUS_CHOICES} top_products = OrderItem.objects.values('product_name').annotate( units=Sum('quantity'), revenue=Sum('product_price') ).order_by('-revenue')[:10] context = { 'monthly_data': json.dumps(monthly), 'status_counts': json.dumps(status_counts), 'top_products': top_products, 'total_revenue': Order.objects.filter( status__in=['paid','processing','shipped','delivered'] ).aggregate(t=Sum('total'))['t'] or 0, 'total_orders': Order.objects.count(), 'avg_order': (Order.objects.aggregate(a=Sum('total'))['a'] or 0), } return render(request, 'dashboard/analytics.html', context) # ─── STAFF MANAGEMENT (Superadmin only) ──────────────────────────────────────── @require_superadmin def staff_list(request): staff = StaffProfile.objects.select_related('user','created_by').order_by('-created_at') pf = _perm_fields() roles = [ ('superadmin','Super Admin'),('manager','Manager'), ('editor','Editor'),('support','Support'),('viewer','Viewer'), ] # Pre-build matrix rows: [{perm_key, perm_label, perm_icon, values:[True/False,...]}] matrix_rows = [] for perm_key, perm_label, perm_icon in pf: row = { 'key': perm_key, 'label': perm_label, 'icon': perm_icon, 'values': [ StaffProfile.ROLE_PERMISSIONS.get(r, {}).get(perm_key, False) for r, _ in roles ] } matrix_rows.append(row) return render(request, 'dashboard/staff/list.html', { 'staff': staff, 'perm_fields': pf, 'roles': roles, 'matrix_rows': matrix_rows, }) @require_superadmin def staff_create(request): if request.method == 'POST': username = request.POST.get('username','').strip() email = request.POST.get('email','').strip() first_name= request.POST.get('first_name','').strip() last_name = request.POST.get('last_name','').strip() password = request.POST.get('password','') role = request.POST.get('role','viewer') if User.objects.filter(username=username).exists(): messages.error(request, 'Username already taken.') elif User.objects.filter(email=email).exists(): messages.error(request, 'Email already registered.') elif len(password) < 8: messages.error(request, 'Password must be at least 8 characters.') else: user = User.objects.create_user( username=username, email=email, password=password, first_name=first_name, last_name=last_name, is_staff=True, ) sp = StaffProfile(user=user, role=role, created_by=request.user) sp.apply_role_defaults() # Override with custom checkboxes for perm in ['can_manage_products','can_manage_categories','can_manage_orders', 'can_manage_customers','can_manage_coupons','can_manage_reviews', 'can_view_analytics','can_manage_staff']: setattr(sp, perm, perm in request.POST) sp.phone = request.POST.get('phone','') if 'avatar' in request.FILES: sp.avatar = request.FILES['avatar'] sp.save() log_activity(request.user, f'Created staff account: {username} ({role})', request=request) messages.success(request, f'Staff account "{username}" created!') return redirect('dashboard:staff_list') return render(request, 'dashboard/staff/form.html', { 'action': 'Create', 'role_choices': StaffProfile.ROLE_CHOICES, 'perm_fields': _perm_fields(), }) @require_superadmin def staff_edit(request, pk): sp = get_object_or_404(StaffProfile, pk=pk) user = sp.user if request.method == 'POST': user.first_name = request.POST.get('first_name','') user.last_name = request.POST.get('last_name','') user.email = request.POST.get('email','') new_pass = request.POST.get('password','') if new_pass: if len(new_pass) < 8: messages.error(request, 'New password must be at least 8 characters.') return redirect('dashboard:staff_edit', pk=pk) user.set_password(new_pass) user.save() sp.role = request.POST.get('role', sp.role) sp.phone = request.POST.get('phone','') sp.is_active = 'is_active' in request.POST for perm in ['can_manage_products','can_manage_categories','can_manage_orders', 'can_manage_customers','can_manage_coupons','can_manage_reviews', 'can_view_analytics','can_manage_staff']: setattr(sp, perm, perm in request.POST) if 'avatar' in request.FILES: sp.avatar = request.FILES['avatar'] sp.save() log_activity(request.user, f'Updated staff account: {user.username}', request=request) messages.success(request, f'Staff account "{user.username}" updated!') return redirect('dashboard:staff_list') return render(request, 'dashboard/staff/form.html', { 'action': 'Edit', 'staff_profile': sp, 'role_choices': StaffProfile.ROLE_CHOICES, 'perm_fields': _perm_fields(), }) @require_superadmin def staff_delete(request, pk): sp = get_object_or_404(StaffProfile, pk=pk) if sp.user == request.user: messages.error(request, 'You cannot delete your own account.') return redirect('dashboard:staff_list') if request.method == 'POST': username = sp.user.username sp.user.delete() log_activity(request.user, f'Deleted staff account: {username}', request=request) messages.success(request, f'Staff account "{username}" deleted.') return redirect('dashboard:staff_list') @require_superadmin def staff_toggle(request, pk): sp = get_object_or_404(StaffProfile, pk=pk) if sp.user == request.user: messages.error(request, 'You cannot deactivate your own account.') return redirect('dashboard:staff_list') sp.is_active = not sp.is_active sp.save() state = 'activated' if sp.is_active else 'deactivated' log_activity(request.user, f'Staff account {state}: {sp.user.username}', request=request) messages.success(request, f'Account "{sp.user.username}" {state}.') return redirect('dashboard:staff_list') @require_superadmin def activity_log(request): logs = ActivityLog.objects.select_related('user').order_by('-timestamp') q = request.GET.get('q','') if q: logs = logs.filter(Q(action__icontains=q) | Q(user__username__icontains=q)) paginator = Paginator(logs, 30) page_obj = paginator.get_page(request.GET.get('page')) return render(request, 'dashboard/activity_log.html', {'logs': page_obj, 'q': q}) # ─── SETTINGS ────────────────────────────────────────────────────────────────── @require_staff def my_settings(request): user = request.user sp = get_staff_profile(user) if request.method == 'POST': user.first_name = request.POST.get('first_name','') user.last_name = request.POST.get('last_name','') user.email = request.POST.get('email','') new_pass = request.POST.get('new_password','') cur_pass = request.POST.get('current_password','') if new_pass: if not user.check_password(cur_pass): messages.error(request, 'Current password is incorrect.') return redirect('dashboard:settings') if len(new_pass) < 8: messages.error(request, 'New password must be at least 8 characters.') return redirect('dashboard:settings') user.set_password(new_pass) user.save() if sp: sp.phone = request.POST.get('phone','') if 'avatar' in request.FILES: sp.avatar = request.FILES['avatar'] sp.save() log_activity(user, 'Updated account settings', request=request) messages.success(request, 'Settings saved!') return redirect('dashboard:settings') return render(request, 'dashboard/settings.html', {'sp': sp}) @require_superadmin def site_settings(request): # Fetch the single configuration row or create it with defaults if it doesn't exist settings_obj, created = SiteSetting.objects.get_or_create(pk=1) if request.method == 'POST': # Pass the POST data directly to our form instance bound to our settings object form = SiteSettingForm(request.POST, instance=settings_obj) if form.is_valid(): form.save() messages.success(request, "Site settings updated successfully!") return redirect('dashboard:site_settings') # Change to match your actual namespace:name else: messages.error(request, "There was an error updating settings. Please check your inputs.") else: form = SiteSettingForm(instance=settings_obj) context = { 'form': form, 'settings': settings_obj, # Useful if you need direct access to values in template } return render(request, 'dashboard/site_settings.html', context) def _perm_fields(): return [ ('can_manage_products', 'Manage Products', 'fa-box'), ('can_manage_categories', 'Manage Categories', 'fa-tags'), ('can_manage_orders', 'Manage Orders', 'fa-shopping-cart'), ('can_manage_customers', 'Manage Customers', 'fa-users'), ('can_manage_coupons', 'Manage Coupons', 'fa-ticket-alt'), ('can_manage_reviews', 'Manage Reviews', 'fa-star'), ('can_view_analytics', 'View Analytics', 'fa-chart-bar'), ('can_manage_staff', 'Manage Staff', 'fa-user-shield'), ]